CVE-2026-55661 TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes

Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant,...

CVE-2026-55661

CVE-2026-55661 affects TinaCMS rich-text rendering (Slate JSON) where the url field on Slate link/image nodes was not sanitized, allowing stored XSS via dangerous URL schemes such as javascript: or data:text/html. Affected versions include tinacms/mdx <2.1.7 and tinacms =2.1.7 and tinacms >...

CVE-2026-13870

creationtimestamp| type| source ---|---|--- 2026-07-01 20:44:01+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmf2a2fkj2d 2026-07-02 07:21:41+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702...

CVE-2026-13889

creationtimestamp| type| source ---|---|--- 2026-07-01 20:43:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmeymz4662i 2026-07-02 07:22:31+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702...

CVE-2026-13885

creationtimestamp| type| source ---|---|--- 2026-07-01 20:40:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmetsdtxb2d 2026-07-02 07:22:22+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 18:50:59+00:00| seen|...

CVE-2026-49857

creationtimestamp| type| source ---|---|--- 2026-07-01 20:35:16+00:00| published-proof-of-concept| https://github.com/ymw0407/auth-fetch-mcp/security/advisories/GHSA-pvrj-8cg3-j5f8...

CVE-2026-13884

creationtimestamp| type| source ---|---|--- 2026-07-01 20:09:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmd4ooo6k2q 2026-07-02 07:22:20+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:17:51+00:00| seen|...

CVE-2026-55577

creationtimestamp| type| source ---|---|--- 2026-07-01 20:07:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmcy6rdbd27 2026-07-02 10:27:49+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnt3c4ngk2r 2026-07-02 11:53:58+00:00| seen|...

CVE-2026-55628

creationtimestamp| type| source ---|---|--- 2026-07-01 20:01:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmcnwywan2v 2026-07-02 10:28:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnt45sf6m2r...

CVE-2026-13813

creationtimestamp| type| source ---|---|--- 2026-07-01 19:59:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmck23pwb2o 2026-07-01 20:56:22+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpmfqclbau2p 2026-07-02 01:30:42+00:00| seen|...

CVE-2026-13812

creationtimestamp| type| source ---|---|--- 2026-07-01 19:50:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmbzmsevo2t 2026-07-02 01:30:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmv27cvmp2b 2026-07-02 07:19:30+00:00| seen|...

GHSA-M492-GV72-XVXJ Kimai Password Reset Link Remains Valid After Password Change

Summary The LoginLink signature used for password reset URLs covers only the user's id — it does not include the password hash. After a user clicks a reset link and successfully changes their password, the same link remains valid for up to 2 additional uses within a 1-hour window. Anyone who...

Weak Password Recovery Mechanism for Forgotten Password

Overview Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password through the loginlink process. An attacker can gain unauthorized access to user accounts by reusing a previously issued password reset link after the password has been changed. Thi...

CVE-2026-13814

creationtimestamp| type| source ---|---|--- 2026-07-01 19:48:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmbwvzc5t2i 2026-07-02 07:19:34+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:15:35+00:00| seen|...

CVE-2026-13811

creationtimestamp| type| source ---|---|--- 2026-07-01 19:48:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmbw2ej462q 2026-07-02 07:19:28+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 12:26:39+00:00| seen|...

CVE-2026-13807

creationtimestamp| type| source ---|---|--- 2026-07-01 19:47:02+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmbuchs6h26 2026-07-02 07:19:19+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 12:29:40+00:00| seen|...

CVE-2026-41121

Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution Before File Access 'Link Following’ vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

CVE-2026-13773

creationtimestamp| type| source ---|---|--- 2026-07-01 18:59:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpm76q5gwb2r 2026-07-06 18:55:02+00:00| seen| https://bsky.app/profile/vulny-app.bsky.social/post/3mpyrbwcy7l2h...

CVE-2025-36336

creationtimestamp| type| source ---|---|--- 2026-07-01 18:57:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpm74jljmt2p...

CVE-2026-41121

Dell Device Management Agent (DDMA) versions before 26.05 are affected by an Improper Link Resolution Before File Access (Link Following) vulnerability. A low-privilege, local attacker could potentially exploit this to achieve Elevation of Privileges. The CVSS3.1 vector is AV:L/AC:L/PR:L/UI:R/S:U...